@sap-ux/fe-fpm-writer 1.1.6 → 1.2.0

package/dist/common/validate.d.ts

@@ -31,4 +31,13 @@ export declare function validateBasePath(basePath: string, fs?: Editor, dependen
  * @returns {string} the error message
  */
 export declare function getErrorMessage(error: Error | unknown): string;
+/**
+ * Validates that a folder path is relative and does not contain path traversal sequences.
+ * This prevents security issues where malicious paths like '../../../etc' could write files outside the project.
+ *
+ * @param {string} folder - the folder path to validate
+ * @param {string} [paramName] - optional parameter name for error messages
+ * @throws {Error} if the path is absolute or contains '..'
+ */
+export declare function validateRelativePath(folder: string, paramName?: string): void;
 //# sourceMappingURL=validate.d.ts.map

package/dist/common/validate.js

@@ -1,6 +1,7 @@
 import { create as createStorage } from 'mem-fs';
 import { create } from 'mem-fs-editor';
 import { coerce, lt } from 'semver';
+import { isAbsolute } from 'node:path';
 import { getManifestPath } from './utils.js';
 /**
  * Validate that the UI5 version requirement is valid.
@@ -68,4 +69,23 @@ export async function validateBasePath(basePath, fs, dependencies = ['sap.fe.tem
 export function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * Validates that a folder path is relative and does not contain path traversal sequences.
+ * This prevents security issues where malicious paths like '../../../etc' could write files outside the project.
+ *
+ * @param {string} folder - the folder path to validate
+ * @param {string} [paramName] - optional parameter name for error messages
+ * @throws {Error} if the path is absolute or contains '..'
+ */
+export function validateRelativePath(folder, paramName = 'Path') {
+    // Check for absolute paths
+    if (isAbsolute(folder)) {
+        throw new Error(`${paramName} must not be an absolute path, got: ${folder}`);
+    }
+    // Check for path traversal attempts by examining path segments
+    const segments = folder.split(/[/\\]/);
+    if (segments.includes('..')) {
+        throw new Error(`${paramName} must not contain '..' (path traversal), got: ${folder}`);
+    }
+}
 //# sourceMappingURL=validate.js.map

package/dist/fragment/index.d.ts

@@ -0,0 +1,17 @@
+import type { Editor } from 'mem-fs-editor';
+import type { Fragment } from './types.js';
+/**
+ * Generate a standalone fragment file with default content.
+ * Does NOT modify manifest.json - fragment-only generation.
+ *
+ * @param {string} basePath - the base path
+ * @param {Fragment} fragment - fragment generation configuration
+ * @param {Editor} [fs] - the mem-fs editor instance
+ * @returns {Promise<Editor>} the updated mem-fs editor instance
+ * @throws {Error} if the project folder is invalid or manifest.json cannot be found
+ * @throws {Error} if sap.fe.templates is missing from manifest.json dependencies (only FPM projects are supported)
+ * @throws {Error} if fragment.folder is an absolute path or contains path traversal sequences (..)
+ * @throws {Error} if fragment.name is an absolute path or contains path traversal sequences (..)
+ */
+export declare function generateFragment(basePath: string, fragment: Fragment, fs?: Editor): Promise<Editor>;
+//# sourceMappingURL=index.d.ts.map

package/dist/fragment/index.js

@@ -0,0 +1,41 @@
+import { create as createStorage } from 'mem-fs';
+import { create } from 'mem-fs-editor';
+import { join, dirname } from 'node:path';
+import { validateBasePath, validateRelativePath } from '../common/validate.js';
+import { getDefaultFragmentContent } from '../common/defaults.js';
+import { copyTpl, createIdGenerator } from '../common/file.js';
+import { getTemplatePath } from '../templates.js';
+import { getManifest } from '../common/utils.js';
+/**
+ * Generate a standalone fragment file with default content.
+ * Does NOT modify manifest.json - fragment-only generation.
+ *
+ * @param {string} basePath - the base path
+ * @param {Fragment} fragment - fragment generation configuration
+ * @param {Editor} [fs] - the mem-fs editor instance
+ * @returns {Promise<Editor>} the updated mem-fs editor instance
+ * @throws {Error} if the project folder is invalid or manifest.json cannot be found
+ * @throws {Error} if sap.fe.templates is missing from manifest.json dependencies (only FPM projects are supported)
+ * @throws {Error} if fragment.folder is an absolute path or contains path traversal sequences (..)
+ * @throws {Error} if fragment.name is an absolute path or contains path traversal sequences (..)
+ */
+export async function generateFragment(basePath, fragment, fs) {
+    fs ??= create(createStorage());
+    await validateBasePath(basePath, fs);
+    const fnGenerateId = await createIdGenerator({ basePath, fsEditor: fs });
+    const { path: manifestPath } = await getManifest(basePath, fs);
+    // Calculate path for fragment with validation
+    const folder = fragment.folder ?? 'ext/fragment';
+    validateRelativePath(folder, 'Fragment folder');
+    validateRelativePath(fragment.name, 'Fragment name');
+    const path = join(dirname(manifestPath), folder);
+    // Generate default content if not provided
+    const content = fragment.content ?? getDefaultFragmentContent('Sample Text', fnGenerateId);
+    // Create fragment file
+    const viewPath = join(path, `${fragment.name}.fragment.xml`);
+    if (!fs.exists(viewPath)) {
+        copyTpl(fs, getTemplatePath('common/Fragment.xml'), viewPath, { content }, fnGenerateId);
+    }
+    return fs;
+}
+//# sourceMappingURL=index.js.map

package/dist/fragment/types.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Fragment generation configuration.
+ */
+export interface Fragment {
+    /**
+     * Fragment name (without .fragment.xml extension).
+     */
+    name: string;
+    /**
+     * Optional folder path relative to webapp directory. Defaults to 'ext/fragment'.
+     */
+    folder?: string;
+    /**
+     * Optional XML content for the fragment. If not provided, a default fragment will be generated.
+     */
+    content?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/fragment/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/index.d.ts

@@ -8,6 +8,8 @@ export { TargetControl as ActionMenuTargetControl } from './action-menu/types.js
 export { generateActionMenu } from './action-menu/index.js';
 export type { CustomTableColumn } from './column/types.js';
 export { generateCustomColumn } from './column/index.js';
+export type { Fragment } from './fragment/types.js';
+export { generateFragment } from './fragment/index.js';
 export type { CustomHeaderSection, CustomSection, CustomSubSection } from './section/types.js';
 export { RequestGroupId, DesignTime } from './section/types.js';
 export { generateCustomSection, generateCustomSubSection, generateCustomHeaderSection } from './section/index.js';

package/dist/index.js

@@ -4,6 +4,7 @@ export { generateCustomAction } from './action/index.js';
 export { TargetControl as ActionMenuTargetControl } from './action-menu/types.js';
 export { generateActionMenu } from './action-menu/index.js';
 export { generateCustomColumn } from './column/index.js';
+export { generateFragment } from './fragment/index.js';
 export { RequestGroupId, DesignTime } from './section/types.js';
 export { generateCustomSection, generateCustomSubSection, generateCustomHeaderSection } from './section/index.js';
 export { generateCustomFilter } from './filter/index.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sap-ux/fe-fpm-writer",
   "description": "SAP Fiori elements flexible programming model writer",
-  "version": "1.1.6",
+  "version": "1.2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/SAP/open-ux-tools.git",
@@ -31,10 +31,10 @@
     "semver": "7.8.4",
     "xml-formatter": "3.7.0",
     "xpath": "0.0.34",
-    "@sap-ux/fiori-annotation-api": "1.0.14",
+    "@sap-ux/fiori-annotation-api": "1.0.15",
     "@sap-ux/i18n": "1.0.2",
     "@sap-ux/project-access": "2.1.6",
-    "@sap-ux/logger": "1.0.2"
+    "@sap-ux/logger": "1.0.3"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -44,7 +44,7 @@
     "@types/mem-fs-editor": "7.0.1",
     "@types/semver": "7.7.1",
     "@types/vinyl": "2.0.12",
-    "@sap-ux/ui-prompting": "1.0.6"
+    "@sap-ux/ui-prompting": "1.0.7"
   },
   "engines": {
     "node": ">=22.x"